---
id: CVE-2026-98489
title: 'net: atl1c: fix soft lockup on out-of-range tpd_cons read'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: atl1c: fix soft lockup on out-of-range tpd_cons read

  The hardware can report an out-of-range tpd_cons (seen as 0xffff)
  while the PCIe link/MAC is resetting. An ou…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    5ea2576a4f5ec476f33169fdbe9090d2b038ad13
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    4daf80da0c38b8cd92c111ad96cb38322aabf586
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    57b55367b6e3accc55a989afeaf127063e3614dc
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    9f2cc71a2e2799d9c993c73f1bd36507eef6ae43
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    586847400b1168a88917287ac02c2c91a620b841
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    d4ab263e40fcf7cfa38a43ec774067d32eb94e16
  - >-
    Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 <
    36c2009d90f2210ef92e6f4f2850e8b57b09e754
  - Linux 2.6.29
published: '2026-10-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:20:26.482Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98489'
references:
  - url: 'https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f'
  - url: 'https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13'
  - url: 'https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586'
  - url: 'https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc'
  - url: 'https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43'
  - url: 'https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841'
  - url: 'https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16'
  - url: 'https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.291Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: atl1c: fix soft lockup on out-of-range tpd_cons read

The hardware can report an out-of-range tpd_cons (seen as 0xffff)
while the PCIe link/MAC is resetting. An out-of-range value can
never be reached and the loop below would spin forever. To avoid
a soft lockup treat it as "nothing new to clean" instead.

Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,
4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that
the ports are directly linked to:

- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap
  precursor, before the lockup was captured with a full trace
  elsewhere:

    atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms
    atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second
    atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>

  65535 (0xffff) here is the same value tpd_cons reads back once the
  loop below gets stuck.

- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time
  caught by the soft lockup watchdog with a full stack trace:

    watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]
    CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)
    RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]
    Call Trace:
     <TASK>
     __napi_poll+0x32/0x1e0
     napi_threaded_poll_loop+0x286/0x2e0
     napi_threaded_poll+0xfd/0x140
     kthread+0xf7/0x130
     ret_from_fork+0x2da/0x3a0
     ret_from_fork_asm+0x1a/0x30
     </TASK>

## Affected

- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < 5ea2576a4f5ec476f33169fdbe9090d2b038ad13`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < 4daf80da0c38b8cd92c111ad96cb38322aabf586`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < 57b55367b6e3accc55a989afeaf127063e3614dc`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < 9f2cc71a2e2799d9c993c73f1bd36507eef6ae43`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < 586847400b1168a88917287ac02c2c91a620b841`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < d4ab263e40fcf7cfa38a43ec774067d32eb94e16`
- `Linux >= 43250ddd75a35d1f7926d989a10fefd30c37eaa7 < 36c2009d90f2210ef92e6f4f2850e8b57b09e754`
- `Linux 2.6.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.